Bug 530820 (CVE-2014-3710-php)

Summary:	<dev-lang/php-{5.4.35,5.5.19}: fileinfo: out-of-bounds read in elf note headers (CVE-2014-3710)
Product:	Gentoo Security	Reporter:	Tomáš Mózes <hydrapolic>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	php-bugs
Priority:	Normal
Version:	unspecified
Hardware:	AMD64
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=531354
Whiteboard:	B2 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	526544

Description Tomáš Mózes 2014-11-27 07:55:40 UTC

Bugfix and security release:

Fileinfo:
Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers). (CVE-2014-3710)

I've been running these on 20 servers since the release on amd64.

Comment 1 Tomáš Mózes 2014-12-01 16:27:20 UTC

On a newly installed machine I encountered a problem with reloading php-fpm instances (https://bugs.gentoo.org/show_bug.cgi?id=531354).

5.5.20 is RC1 with some fixes regarding PHP-FPM (https://github.com/php/php-src/blob/PHP-5.5.20/NEWS)

Comment 2 Kristian Fiskerstrand (RETIRED) gentoo-dev

2015-01-02 22:03:10 UTC

Added to existing GLSA. Putting in cleanup state due to PHP 5.3 still being in tree.

Comment 3 Sergey Popov gentoo-dev

2015-03-07 09:25:47 UTC

Cleanup would be done in bug #533998

Comment 4 GLSAMaker/CVETool Bot gentoo-dev

2015-03-08 14:38:00 UTC

This issue was resolved and addressed in
 GLSA 201503-03 at http://security.gentoo.org/glsa/glsa-201503-03.xml
by GLSA coordinator Kristian Fiskerstrand (K_F).